Threat Researcher

Abnormal

2d•$122,400 - $176,000

About The Position

Abnormal AI is seeking a Threat Researcher to join its Threat Intelligence team. This analyst role focuses on investigating active campaigns, attacker behavior, and emerging email and identity attack techniques, then synthesizing technical research, data, threat context, and audience needs into clear, useful intelligence. The researcher will develop assessments and recommendations, create intelligence products for varied audiences, and explain how technical threats relate to business risk. The role works closely with Threat Intelligence, Detection, Sales, Customer Success, and Marketing. It includes direct engagement with customers and prospects through briefings, presentations, webinars, and tailored content. The researcher will independently lead complex investigations and high-visibility engagements, adapt communications to different audiences, and contribute to the development of other analysts through mentoring, peer review, and knowledge sharing. AI tools and automation are used to accelerate research and content workflows, with human review to maintain accuracy and analytical rigor.

Requirements

At least 4 years of experience in threat intelligence, SOC operations, or a closely related cybersecurity discipline.
Working knowledge of email and identity attack techniques and ability to understand and explain IOCs, TTPs, attack campaigns, and threat behavior.
Experience conducting security research and producing written intelligence or security content for different audiences.
Ability to synthesize technical research and data from multiple sources into clear assessments, narratives, and recommendations.
Analytical judgment in complex or ambiguous investigations, including evaluating incomplete or conflicting evidence and developing defensible assessments with limited direction.
Familiarity with threat intelligence platforms, intelligence-sharing communities, and threat hunting concepts.
Strong writing skills and ability to communicate complex technical subjects clearly and concisely.
Ability to independently present complex technical intelligence to customers, executives, security practitioners, or other stakeholders, adapt communication to the audience, and respond confidently to questions or challenges.
Experience working directly with customers or cross-functional stakeholders and translating technical findings into business relevance.
Proficiency with AI tools such as ChatGPT, Claude, Claude Code, Copilot, or similar tools to enhance research, analysis, and writing.
Strong project management and prioritization skills, including managing competing requests and delivering high-quality work on time.
Ability to remain calm, accurate, and responsive in high-pressure or time-sensitive situations.
Ability to independently scope, prioritize, and deliver complex intelligence work from investigation through final assessment and customer-ready communication, and identify opportunities to improve analytical quality and workflows.
Ability and willingness to strengthen other analysts' technical capabilities through peer review, knowledge sharing, coaching, and collaborative problem-solving.
Demonstrated use of AI tools or automation to scale research, analysis, or content production.
Working knowledge of the MITRE ATT&CK framework and common attack techniques, including phishing, business email compromise, credential harvesting, malware, and account takeover, and ability to apply this knowledge to threat research and assessments.
Basic proficiency in SQL, including writing and modifying queries to retrieve, filter, and analyze datasets for research and investigations.

Nice To Haves

Experience in email security, phishing detection, anti-abuse systems, or email threat containment.
Experience in detection engineering, incident response, and email security analysis.
Experience with Abnormal Security or similar security platforms.
Public-facing security content experience, such as published research, blogs, conference talks, webinars, or industry reports.
Experience creating intelligence content for sales cycles, customer QBRs, or other customer-facing security engagements.
Experience creating training or enablement materials for Sales, Customer Success, or other non-technical teams.
Experience mentoring, coaching, or training earlier-career security analysts.
Experience using Python or other scripting tools to automate data analysis, investigate threat activity, or improve research workflows.
Security certifications such as Security+, GIAC (GCTI, GCIH), CISSP, CEH, or similar.

Responsibilities

Independently scope and lead complex or ambiguous investigations into campaigns, attacker behavior, TTPs, and emerging email and identity attack techniques.
Use Abnormal's platform, internal telemetry and data, threat intelligence sources, and external research to investigate threats and develop assessments.
Identify patterns, connections, and emerging trends across threat activity.
Develop understanding of how Abnormal detects and responds to analyzed threats.
Synthesize intelligence from disparate or conflicting sources into defensible assessments and recommendations tailored to the audience and decision.
Translate findings into insights, implications, recommendations, and clear narratives that connect technical activity to business risk.
Produce threat briefs, analytical reports, customer QBR content, customer and prospect briefings, webinars, presentations, marketing and outreach content, and executive summaries.
Create rapid-turnaround and in-depth intelligence products, and build reusable narratives, templates, and content structures.
Maintain sourcing, analytical accuracy, clarity, and editorial quality.
Independently lead customer and prospect engagements, including complex or high-visibility briefings, webinars, and presentations; adapt in real time and respond to questions and challenges.
Work with Sales and Customer Success to understand requests and tailor intelligence; respond to time-sensitive questions and high-priority pursuits.
Develop relationships with customer-facing stakeholders and use their feedback to improve intelligence products.
Collaborate with Threat Intelligence and Detection teams to incorporate research and technical findings into customer-ready intelligence.
Coach and mentor P1 and P2 analysts through peer review, knowledge sharing, and support for analytical judgment, research methods, synthesis, and product quality.
Partner with Sales, Customer Success, and Marketing on customer moments, pursuits, and content needs; provide targeted enablement materials.
Share insights from customer and field interactions with Threat Intelligence teams to inform research and detection priorities.
Use AI tools to accelerate research, synthesis, drafting, tailoring, and editing, applying human review and validation.
Develop practical workflows and automation to reduce routine work while maintaining analytical rigor.